1616345 : Access to cern eos is denied only when I run on condor

Created: 2026-07-10T15:05:59Z - current status: new

Summary

A user reports an issue when submitting jobs via Condor to process .root files stored on CERN EOS. While local execution works fine, Condor jobs fail with a FileNotFoundError, specifically indicating "unauthorized identity" ([3010] Unable to give access - user access restricted).

The error originates from uproot's attempt to open the file via XRootD:

FileNotFoundError: file not found ([ERROR] Server responded with an error: [3010] Unable to give access - user access restricted - unauthorized identity used ; Permission denied )

Possible Causes & Solution

  1. Authentication Issue:
  2. Condor jobs may lack proper authentication tokens (e.g., Kerberos ticket, grid proxy) required to access EOS.

  3. Next Step: Ensure the job environment includes valid credentials (e.g., kinit, voms-proxy-init). For NAF/DUST clusters, check if the job inherits the user’s auth tokens.

  4. XRootD Configuration:

  5. The worker nodes might misconfigure XRootD client settings (e.g., wrong redirector or missing permissions).

  6. Next Step: Verify XRootD client setup on Condor workers (e.g., /etc/xrootd/client.conf).

  7. Parsl/Condor Integration:

  8. Parsl’s executor may not propagate authentication correctly.

  9. Next Step: Check Parsl’s configuration for credential handling (e.g., authentication=True in HighThroughputExecutor).

  10. Path Resolution:

  11. Confirm the full path (root://eoscms.cern.ch//eos/cms/...) is accessible from worker nodes. Test manually from a worker node: bash xrdfs root://eoscms.cern.ch ls /eos/cms/store/group/phys_higgs/...

Suggested Action: - Reproduce the issue interactively on a Condor worker node to isolate whether it’s an auth or config problem. - Consult NAF support for cluster-specific guidance on accessing EOS via Condor.

Sources: Error traceback analysis.